Apple T2 Chip 2018 ...
 
Notifications
Clear all

Apple T2 Chip 2018 model Macbook and iMac

18 Posts
7 Users
0 Likes
3,908 Views
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

Im testing a Macbook Pro 2018 model, OS version 10.13.6 which has a T2 chip.

I have tried booting to Macquisition (latest version), however the Mac will not allow it to boot. I have disabled secure boot, allowing boot media to be run from a external source, just shows the prohibited symobl.

I have booted it into target disk mode and connected another 2018 Macbook with T2 and also a 2017 Macbook to it via USB C whilst running Macquisition. Still no luck.

Having looked online there are many posts on various geek forums, none appear to have come up with an answer.

Anyone here have anyluck ?

Thanks

 
Posted : 29/10/2018 8:50 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

I haven't had one of those devices through yet, but have you tried contacting manufacturer?
They are pretty good for issues like this.

 
Posted : 30/10/2018 7:19 am
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

I tired to contact Tim Cook at Apple, he hasn't returned my call yet, I guess he's busy today. lol

I have spoken to some Blacklight trainers and they are in the dark too at the moment.

 
Posted : 30/10/2018 8:24 am
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

See below link to Apples paper on the T2 chip

https://www.apple.com/euro/mac/shared/docs/Apple_T2_Security_Chip_Overview.pdf

 
Posted : 30/10/2018 7:14 pm
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

Update

It seems after booting the Macbook into Target Disk Mode (TDM) i connected a generic thunderbolt cable oops oops .

I have since purchased a thunderbolt 3 cable, Macbook in TDM and my forensic mac booted to Macquisiton to enable write blocking and the Mac then pops up on my Forensis machine for acquisition.

So it does work, just make sure you use thunderbolt 3 cable.

 
Posted : 09/11/2018 2:16 pm
(@lammy_uk)
Posts: 3
New Member
 

Can you tell me if the test machine you were acquiring had FileVault II enabled or not? If so, at what point (if any) were you prompted to enter the password by MacQuisition?
Thanks

 
Posted : 28/11/2018 1:20 pm
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

Yes it had fv2.

Macquisiton will tell you if the drive you wish to acquire is encrypted. The macquisiton manual tells you all about how to acquire and decrypt with the password.

 
Posted : 28/11/2018 4:15 pm
CFEx
 CFEx
(@cfex)
Posts: 69
Trusted Member
 

50-50 chance that MDM may be enabled. I ran into this issue a while ago and it was MDM. If in your case it is MDM, MDM has to be manually disabled in System Preferences and then you will be able to image the hard drive.

If it is not MDM, you are back to square one.

 
Posted : 28/11/2018 4:17 pm
(@lammy_uk)
Posts: 3
New Member
 

Thanks for the info. One last question Was the 'forensic' Mac you booted into MacQuisition also a T2 model or older? Thanks again.

 
Posted : 28/11/2018 5:23 pm
(@dandaman_24)
Posts: 172
Estimable Member
Topic starter
 

Booted my 2017 MBP T1 chip Mac into macquisiton. I then put the 2018 MBP T2 chip into TDM and connected to my 2017 MBP.

This way the target device is write blocked.

 
Posted : 28/11/2018 5:47 pm
Page 1 / 2
Share: